Week 51, 2019
16–22 December 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2019-4716 IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute…EPSS 86%
- Critical 9.8 EPSS 70%
- Critical 9.8 EPSS 54%
- Critical 9.8 EPSS 7.1%
- Critical 9.8 EPSS 4.2%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.2%
-
Critical 10.0
CVE-2019-17440 PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root accessEPSS 1.7%
- Critical 9.8 EPSS 1.3%
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2019-7481 Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.…EPSS 100%
-
Unscored
CVE-2019-3993 ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by se…EPSS 46%
-
Unscored
CVE-2019-16451 Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and…EPSS 35%
-
Unscored
CVE-2019-3995 ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash th…EPSS 29%
-
Unscored
CVE-2019-19368 A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link …EPSS 24%
-
Unscored
CVE-2019-19908 phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.p…EPSS 21%
-
Unscored
CVE-2019-8600 A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes…EPSS 20%
-
Unscored
CVE-2019-19742 On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.EPSS 20%
Advisories
- SUSE / openSUSE Security Updates 30
- Debian Security (DSA / DLA) 201 critical
- CISA ICS & IT advisories 61 critical
- AlmaLinux Security Advisories 6
- Oracle Linux Security Advisories (ELSA) 51 critical
- BSI CERT-Bund (WID) 4
- Ubuntu Security Notices (USN) 31 critical
- Rocky Linux Security Advisories 2
- Amazon Linux Security Center (ALAS) 11 critical
- CERT@VDE 11 critical
- VDE-2019-022 WAGO: Multiple Vulnerabilities in I/O-Check Service in Multiple Devices 7 CVEs
- USN-4224-1 python-django vulnerability 1 CVEs
- ICSA-19-353-02 Equinox Control Expert 1 CVEs
- DLA-2042-1 python-django - security update 1 CVEs
- ALAS2-2019-1378 Critical: openslp security update (Amazon Linux 2) 1 CVEs
- ELSA-2019-4240 Critical: openslp security update (Oracle Linux 7) 1 CVEs